CVE-2026-46047 net: qrtr: ns: Fix use-after-free in driver remove()

High 7.8 Published 27 May 2026 Updated 15 Oct 2026

A use-after-free in the Linux kernel QRTR namespace driver allows attackers to cause denial of service or execute code via race conditions during driver removal.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-46047?

CVE-2026-46047 is a high-severity use after free vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: ns: Fix use-after-free in driver remove()

In the remove callback, if a packet arrives after destroy_workqueue() is called, but before sock_release(), the qrtr_ns_data_ready() callback will try to queue the work, causing use-after-free issue.

Fix this issue by saving the default 'sk_data_ready' callback during qrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at the start of remove(). This ensures that even if a packet arrives after destroy_workqueue(), the work struct will not be dereferenced.

Note that it is also required to ensure that the RX threads are completed before destroying the workqueue, because the threads could be using the qrtr_ns_data_ready() callback.

Weakness: CWE-416

Which versions are affected by CVE-2026-46047?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-46047?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-46047 being exploited?

There is no known exploitation of CVE-2026-46047 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-88440, BELL-CVE-2026-46047, DEBIAN-CVE-2026-46047, GHSA-g5x6-jrf2-h8qv, ROOT-OS-DEBIAN-11-CVE-2026-46047, ROOT-OS-DEBIAN-12-CVE-2026-46047 and 3 more.